Overview

overview

10

Static

static

3

NPCC Enqui...51.exe

windows7-x64

10

NPCC Enqui...51.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29-04-2024 09:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NPCC Enquiry ref (RFQ)- GPO-16- 0101-CPF- MR-PSD-16-055-Request For Quotation OGC-PR-16-6000000351.exe

  • Size

    983KB

  • MD5

    56d373b5443c15c4f2709ded9aedc848

  • SHA1

    d37b67bb8a6edf795793d10b007ee3fa79745ab8

  • SHA256

    7ed6e1978285b46db8a796f0df455c0843046e117eca2e41231b8dc0231fdfad

  • SHA512

    bdece2e7dd0739fde11288b5e2b833bf5f77bcfaea4ab106d43ded1c733bbeca64941603d630fd3d1179c548ec679cf5e7baea5c62f837b1f9be5fbd4961b35c

  • SSDEEP

    12288:utqItUpkwHobEdEufPj9JBnuMOlk0P7E/fjhfrLns+7vhKY+mzbvDh:kBtzwHobQEgPNwkKs7hfHnN7vhKmzTd

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Uses the VBS compiler for execution 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NPCC Enquiry ref (RFQ)- GPO-16- 0101-CPF- MR-PSD-16-055-Request For Quotation OGC-PR-16-6000000351.exe
    "C:\Users\Admin\AppData\Local\Temp\NPCC Enquiry ref (RFQ)- GPO-16- 0101-CPF- MR-PSD-16-055-Request For Quotation OGC-PR-16-6000000351.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1812
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\NPCC Enquiry ref (RFQ)- GPO-16- 0101-CPF- MR-PSD-16-055-Request For Quotation OGC-PR-16-6000000351.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2088
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kkYmBg.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2556
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kkYmBg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp41F0.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2644
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1784

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1
T1064

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp41F0.tmp
    Filesize

    1KB

    MD5

    fd864550b44edf7585e360c339ac047f

    SHA1

    54d395cf2db2571339ea970670f485742d4152f2

    SHA256

    aaba0a929a33c54865f1b5e97352a8e7e67abb3d8c7bd11bf065dc7d28a95602

    SHA512

    3c6d15de283aa58495957c3b06a09b6d162ee484f32b2d23aaaf25d5e07c2e537d4a1a92d1d6c5512c41f58bc2dbed84e8872e569b4493a73eccfdc81f53caf4

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\485NZT3903QVX5DYR0T8.temp
    Filesize

    7KB

    MD5

    c1289c519a118530fac67cf9af80aaf7

    SHA1

    068bfee4d83361acf83df448706074dabe2a7d14

    SHA256

    246caf3e7cb03c7423f15cde238d73e45e8ed2b55209777d726657b8c1608369

    SHA512

    c7ce07da6c03dac5785d36eb1732ca17f979d64bb434b4a14087e872f8e01921caebd51f84519ff131dfd93ec2901690777cd95e154da9532f3339fd1b54ccd7

    Download Submit
  • memory/1784-29-0x0000000000400000-0x0000000000442000-memory.dmp
    Filesize

    264KB

    Download
  • memory/1784-19-0x0000000000400000-0x0000000000442000-memory.dmp
    Filesize

    264KB

    Download
  • memory/1784-21-0x0000000000400000-0x0000000000442000-memory.dmp
    Filesize

    264KB

    Download
  • memory/1784-23-0x0000000000400000-0x0000000000442000-memory.dmp
    Filesize

    264KB

    Download
  • memory/1784-27-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1784-28-0x0000000000400000-0x0000000000442000-memory.dmp
    Filesize

    264KB

    Download
  • memory/1784-30-0x0000000000400000-0x0000000000442000-memory.dmp
    Filesize

    264KB

    Download
  • memory/1784-25-0x0000000000400000-0x0000000000442000-memory.dmp
    Filesize

    264KB

    Download
  • memory/1812-6-0x0000000000660000-0x000000000070A000-memory.dmp
    Filesize

    680KB

    Download
  • memory/1812-1-0x0000000074470000-0x0000000074B5E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1812-0-0x00000000002A0000-0x000000000039C000-memory.dmp
    Filesize

    1008KB

    Download
  • memory/1812-2-0x0000000004A70000-0x0000000004AB0000-memory.dmp
    Filesize

    256KB

    Download
  • memory/1812-3-0x0000000000230000-0x0000000000248000-memory.dmp
    Filesize

    96KB

    Download
  • memory/1812-5-0x0000000000280000-0x0000000000294000-memory.dmp
    Filesize

    80KB

    Download
  • memory/1812-4-0x0000000000270000-0x000000000027E000-memory.dmp
    Filesize

    56KB

    Download
  • memory/1812-31-0x0000000074470000-0x0000000074B5E000-memory.dmp
    Filesize

    6.9MB

    Download